Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2023, 21:08

General

  • Target

    0bd2d2249f2eb09386e1027bef7431421ddb934146c82a275572bf83a74edd97.exe

  • Size

    791KB

  • MD5

    80b56b758c631c6e138eb8cac4514370

  • SHA1

    30244ab823eb3ed089342c936065008f0e15b77a

  • SHA256

    0bd2d2249f2eb09386e1027bef7431421ddb934146c82a275572bf83a74edd97

  • SHA512

    8614d4b0897358311d85c87e92bde5e497ce732e5d02bafdacb155fdf0675a174d4b7262fdfbe7c7ec03518430b5cedc5d0ac4446947a315c912f41193d632b1

  • SSDEEP

    24576:NyjmbfcnglYqdz6qWrqirvXkV3v0ph+EB:ojmDcnglYkz6/qiTXcKh+

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

laba

C2

193.233.20.28:4125

Attributes
  • auth_value

    2cf01cffff9092a85ca7e106c547190b

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0bd2d2249f2eb09386e1027bef7431421ddb934146c82a275572bf83a74edd97.exe
    "C:\Users\Admin\AppData\Local\Temp\0bd2d2249f2eb09386e1027bef7431421ddb934146c82a275572bf83a74edd97.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3846.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3846.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2077.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2077.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2432
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1684Ef.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1684Ef.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1096
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c12YJ78.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c12YJ78.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4940
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1080
            5⤵
            • Program crash
            PID:4172
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWwVL43.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWwVL43.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2736
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1696
          4⤵
          • Program crash
          PID:520
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e07jw50.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e07jw50.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:972
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4940 -ip 4940
    1⤵
      PID:408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2736 -ip 2736
      1⤵
        PID:1144
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:4080

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e07jw50.exe

        Filesize

        175KB

        MD5

        478e884952392c14b85cca1a6a4f3e35

        SHA1

        f3475db1427fec3eedf583f1b7b0f839b27f8d74

        SHA256

        bc576bf5f9a72ebbfbc11e59b8e384a1923eca8ec6c5234313c37865f74b7413

        SHA512

        b3a1c504d2a108049a5ee193da2f1bcdd99d269e75f08199c3fccedc0de298996418421b5e48d5c0f582bf775087537ff8f83c341ed2c0cbbcf38e956bffebe9

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e07jw50.exe

        Filesize

        175KB

        MD5

        478e884952392c14b85cca1a6a4f3e35

        SHA1

        f3475db1427fec3eedf583f1b7b0f839b27f8d74

        SHA256

        bc576bf5f9a72ebbfbc11e59b8e384a1923eca8ec6c5234313c37865f74b7413

        SHA512

        b3a1c504d2a108049a5ee193da2f1bcdd99d269e75f08199c3fccedc0de298996418421b5e48d5c0f582bf775087537ff8f83c341ed2c0cbbcf38e956bffebe9

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3846.exe

        Filesize

        646KB

        MD5

        2e7b2492f146f3430d8457d07f1b838f

        SHA1

        5289eb569a9ee4e8be03e46c5f66c12ced52729f

        SHA256

        8325bd4401c793ee3cd0b4102f41c7388ecd6941d1315b9333dce22cbe759e46

        SHA512

        a48caa824e3e083ecd83a52d9dc0ce74d87d273d871a99a19776eb3eabecc748d069bc06e03396cde87e646c8542b485318b1c6f0d9c9a3cbeb6566955248dd6

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3846.exe

        Filesize

        646KB

        MD5

        2e7b2492f146f3430d8457d07f1b838f

        SHA1

        5289eb569a9ee4e8be03e46c5f66c12ced52729f

        SHA256

        8325bd4401c793ee3cd0b4102f41c7388ecd6941d1315b9333dce22cbe759e46

        SHA512

        a48caa824e3e083ecd83a52d9dc0ce74d87d273d871a99a19776eb3eabecc748d069bc06e03396cde87e646c8542b485318b1c6f0d9c9a3cbeb6566955248dd6

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWwVL43.exe

        Filesize

        283KB

        MD5

        27b307972eb7d6697a26e274b9e19cfd

        SHA1

        89e0dce99494161cb5be08c13e702f419ab51432

        SHA256

        2bceb69ad10ed10fa44ddacd997ec5a165b132804c2daeb62b72974727d70d3f

        SHA512

        4f804356a6de31734f50d7099c465bd8d37b2428be98712a36ceb97bee254d6e8fb37707ce62044a3f6cf3f85336cce4d8269994ad91273df07baacc39b90160

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWwVL43.exe

        Filesize

        283KB

        MD5

        27b307972eb7d6697a26e274b9e19cfd

        SHA1

        89e0dce99494161cb5be08c13e702f419ab51432

        SHA256

        2bceb69ad10ed10fa44ddacd997ec5a165b132804c2daeb62b72974727d70d3f

        SHA512

        4f804356a6de31734f50d7099c465bd8d37b2428be98712a36ceb97bee254d6e8fb37707ce62044a3f6cf3f85336cce4d8269994ad91273df07baacc39b90160

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2077.exe

        Filesize

        323KB

        MD5

        d9cbd09054f73590f0f59b5185612998

        SHA1

        d0364465b56cb85129856ad4d792e3dff9751464

        SHA256

        091e555e9b0d04f0a15c3b47d35ea07cedfacd2244015ae926bb44b0b426ba58

        SHA512

        4ef2b2fd3763f5f4ab27fe37a1b93a4babddaac0033ad5be6e6f3a19b52b9d150d9703c041fa7530302cc9e91c35e3f2a9a71f299ae7a1809863577fc9aa2b86

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2077.exe

        Filesize

        323KB

        MD5

        d9cbd09054f73590f0f59b5185612998

        SHA1

        d0364465b56cb85129856ad4d792e3dff9751464

        SHA256

        091e555e9b0d04f0a15c3b47d35ea07cedfacd2244015ae926bb44b0b426ba58

        SHA512

        4ef2b2fd3763f5f4ab27fe37a1b93a4babddaac0033ad5be6e6f3a19b52b9d150d9703c041fa7530302cc9e91c35e3f2a9a71f299ae7a1809863577fc9aa2b86

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1684Ef.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1684Ef.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c12YJ78.exe

        Filesize

        225KB

        MD5

        825920d57cab7dfda81a544bd6043839

        SHA1

        cb23f65202c2263fa8c93dfd7949071817d3c3dc

        SHA256

        ef155beee01e08123ab0f759217cf00c50f5bc0f7d5bf75040eb9a338be46a03

        SHA512

        92ab001f5b1d175b924af20fd688efdc689ee90fdefae1ebaccc12171ddff9fb3f6ed08b069918f1ac41fea256c6ad98d5e138c5c496289bdfafd0edc4e0af22

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c12YJ78.exe

        Filesize

        225KB

        MD5

        825920d57cab7dfda81a544bd6043839

        SHA1

        cb23f65202c2263fa8c93dfd7949071817d3c3dc

        SHA256

        ef155beee01e08123ab0f759217cf00c50f5bc0f7d5bf75040eb9a338be46a03

        SHA512

        92ab001f5b1d175b924af20fd688efdc689ee90fdefae1ebaccc12171ddff9fb3f6ed08b069918f1ac41fea256c6ad98d5e138c5c496289bdfafd0edc4e0af22

      • memory/972-1132-0x00000000055F0000-0x0000000005600000-memory.dmp

        Filesize

        64KB

      • memory/972-1131-0x0000000000D30000-0x0000000000D62000-memory.dmp

        Filesize

        200KB

      • memory/972-1134-0x00000000055F0000-0x0000000005600000-memory.dmp

        Filesize

        64KB

      • memory/1096-154-0x0000000000DA0000-0x0000000000DAA000-memory.dmp

        Filesize

        40KB

      • memory/2736-475-0x0000000004AF0000-0x0000000004B00000-memory.dmp

        Filesize

        64KB

      • memory/2736-1114-0x00000000058D0000-0x000000000590C000-memory.dmp

        Filesize

        240KB

      • memory/2736-1125-0x0000000006E90000-0x0000000006EE0000-memory.dmp

        Filesize

        320KB

      • memory/2736-1124-0x0000000006E10000-0x0000000006E86000-memory.dmp

        Filesize

        472KB

      • memory/2736-1123-0x0000000004AF0000-0x0000000004B00000-memory.dmp

        Filesize

        64KB

      • memory/2736-1122-0x0000000004AF0000-0x0000000004B00000-memory.dmp

        Filesize

        64KB

      • memory/2736-1121-0x0000000004AF0000-0x0000000004B00000-memory.dmp

        Filesize

        64KB

      • memory/2736-1120-0x0000000004AF0000-0x0000000004B00000-memory.dmp

        Filesize

        64KB

      • memory/2736-1119-0x0000000006550000-0x0000000006A7C000-memory.dmp

        Filesize

        5.2MB

      • memory/2736-1118-0x0000000006380000-0x0000000006542000-memory.dmp

        Filesize

        1.8MB

      • memory/2736-1116-0x0000000005C60000-0x0000000005CC6000-memory.dmp

        Filesize

        408KB

      • memory/2736-1115-0x0000000005BC0000-0x0000000005C52000-memory.dmp

        Filesize

        584KB

      • memory/2736-1113-0x0000000004AF0000-0x0000000004B00000-memory.dmp

        Filesize

        64KB

      • memory/2736-1112-0x00000000058B0000-0x00000000058C2000-memory.dmp

        Filesize

        72KB

      • memory/2736-1111-0x0000000005770000-0x000000000587A000-memory.dmp

        Filesize

        1.0MB

      • memory/2736-1110-0x00000000050F0000-0x0000000005708000-memory.dmp

        Filesize

        6.1MB

      • memory/2736-473-0x0000000004AF0000-0x0000000004B00000-memory.dmp

        Filesize

        64KB

      • memory/2736-200-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-201-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-203-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-205-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-207-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-209-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-211-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-213-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-215-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-217-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-219-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-221-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-223-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-225-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-227-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-229-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-231-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-233-0x00000000050B0000-0x00000000050EE000-memory.dmp

        Filesize

        248KB

      • memory/2736-469-0x0000000002110000-0x000000000215B000-memory.dmp

        Filesize

        300KB

      • memory/2736-471-0x0000000004AF0000-0x0000000004B00000-memory.dmp

        Filesize

        64KB

      • memory/4940-185-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-183-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-169-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-195-0x0000000000400000-0x00000000004B8000-memory.dmp

        Filesize

        736KB

      • memory/4940-193-0x00000000024B0000-0x00000000024C0000-memory.dmp

        Filesize

        64KB

      • memory/4940-192-0x0000000000400000-0x00000000004B8000-memory.dmp

        Filesize

        736KB

      • memory/4940-171-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-191-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-189-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-181-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-165-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-167-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-187-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-179-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-177-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-175-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-173-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-164-0x00000000024D0000-0x00000000024E2000-memory.dmp

        Filesize

        72KB

      • memory/4940-163-0x00000000024B0000-0x00000000024C0000-memory.dmp

        Filesize

        64KB

      • memory/4940-162-0x00000000024B0000-0x00000000024C0000-memory.dmp

        Filesize

        64KB

      • memory/4940-161-0x0000000000740000-0x000000000076D000-memory.dmp

        Filesize

        180KB

      • memory/4940-160-0x0000000004AB0000-0x0000000005054000-memory.dmp

        Filesize

        5.6MB